3 ms·
No, it is not a flaw in the OAuth core logic. From the paper's intro: > "the OAuth2.0 standard does not cover or define the critical security requirements and
by ademarre 10y ago
No, it is not a flaw in the OAuth core logic. From the paper's intro:
> "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (client-side) mobile app and its corresponding backend server during the SSO process. As a result, various IdPs have developed different home-brewed extensions..."
- mSparks 10y agoHow does not defining the security protocols of your authentication protocol not count as a flaw in the core logic? An entry security product that doesnt define any security on entering... Pure Genius.
- tecmobowlbo 10y agoI believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.
- mSparks 10y agohttps://m.youtube.com/watch?v=zKuFu19LgZA https://m.youtube.com/watch?v=zKuFu19LgZA